Re: [PATCH bpf v3 4/5] selftests/bpf: Add test for key-less BTF hash map

[Ihor Solodrai <ihor.solodrai@linux.dev>]

On 8/31/26 4:01 AM, Jiayuan Chen wrote:
> Create a hash and an rhash map with btf_key_type_id == 0 and expect
> bpf_map_create() to fail with -EINVAL; a positive control with a real
> key type confirms the rejection is about the key-less BTF. On an unfixed
> kernel the map is created, and the test pins and reads it back to walk
> the bpffs dump path, which reproduces the btf_type_show() NULL-deref - so
> running it on an unfixed kernel oopses the reading task (and panics it
> under panic_on_oops).
> 
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>  .../bpf/prog_tests/btf_map_keyless.c          | 82 +++++++++++++++++++
>  1 file changed, 82 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c b/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
> new file mode 100644
> index 000000000000..a7d037f57a7e
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
> @@ -0,0 +1,82 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <test_progs.h>
> +#include <bpf/btf.h>
> +
> +/*
> + * A hash map with a key-less BTF (btf_key_type_id == 0) used to NULL-deref in
> + * btf_type_show() when dumped via bpffs.
> + * A fixed kernel rejects such a map at creation; on an unfixed kernel the
> + * pin-and-read below deliberately walks that bpffs dump path, so it doubles
> + * as a reproducer: it oopses an unfixed kernel (and panics it under
> + * panic_on_oops).
> + */
> +static void check_keyless(int map_type, __u32 map_flags, int btf_fd, int val_id)
> +{
> +	LIBBPF_OPTS(bpf_map_create_opts, opts);
> +	const char *path = "/sys/fs/bpf/keyless_map";
> +	__u32 key = 1, val = 0x41424344;
> +	char buf[256];
> +	int map_fd;
> +	FILE *f;
> +
> +	opts.map_flags = map_flags;
> +	opts.btf_fd = btf_fd;
> +	opts.btf_value_type_id = val_id;
> +
> +	/*
> +	 * Positive control: the same map with a real key type must be accepted,
> +	 * so the -EINVAL below is about the key-less BTF and not some unrelated
> +	 * rejection (e.g. an unknown map type).
> +	 */
> +	opts.btf_key_type_id = val_id;
> +	map_fd = bpf_map_create(map_type, "keyed_map", 4, 4, 8, &opts);
> +	if (!ASSERT_GE(map_fd, 0, "keyed create is accepted"))
> +		return;
> +	close(map_fd);
> +
> +	/* A key-less BTF must be rejected. */
> +	opts.btf_key_type_id = 0;
> +	map_fd = bpf_map_create(map_type, "keyless_map", 4, 4, 8, &opts);
> +
> +	if (map_fd >= 0) {
> +		/* Unfixed kernel: reproduce the oops via the bpffs dump path. */
> +		(void)bpf_map_update_elem(map_fd, &key, &val, 0);
> +		if (bpf_obj_pin(map_fd, path) == 0) {
> +			f = fopen(path, "r");
> +			if (f) {
> +				while (fgets(buf, sizeof(buf), f))
> +					;
> +				fclose(f);
> +			}
> +			unlink(path);
> +		}
> +		close(map_fd);
> +	}

The whole `if (map_fd >= 0) { ... }` block can be dropped.

If the map has been accepted (0 instead of -EINVAL), it already catches the bug.
It's unnecessary to reproduce the NULL ptr splat.

pw-bot: cr

Also, I think it would be useful to refactor and extend existing
selftests that were added for the features (for example an old
prog_tests/snprintf_btf.c), instead of adding a new test program for
every regression case. Not a blocker, but an effort in that direction
would be much appreciated.

Thanks!

> +
> +	ASSERT_EQ(map_fd, -EINVAL, "key-less create is rejected");
> +}
> +
> [...]